Forum archive
The user interacts not with the operating system, but with applications. The applications themselves can't do much of anything. In order to get something done, they have to interact with the operating system - which in turns acts as a sort of link between the computer and the application. So if the application, for example, wants to know what files are currently residing in C:\windows\system32\ it simply asks the operating system and the operating system returns an answer. In other words, every single little piece of information that the anti-virus application gets comes from the operating system.Before I go into what happens when you're infected with a virus, let me preface this by saying that this doesn't necessarily have to be the case - but that doesn't matter. What matters is that this can be the case, and there would be no way for you to know. Now, here's what a virus could do to the information chain that we saw above.
As you can see, the virus could act as an intermediary between the applications and the operating system. So now when an application sends a request to the operating system, the virus could do whatever it wanted to that request. It could let it pass through without ever even touching it, which would mean you wouldn't notice anything odd. It could change the request to something entirely different, or it could change the response to its liking.As we previously established, anti-virus software are simply applications - just like any other - that get their information by asking the operating system for it. If the computer is infected, that information could come directly from the virus, and there is no way that the anti-virus could know the difference. So if the anti-virus asks if a certain file exists (C:\pornstash\evilviruz.exe), the virus could analyze the request and see that it's coming from an anti-virus and return: "Nope, there's no such file. You're clean!".In other words, once you have been infected the virus could have complete control over your operating system - and subsequently your applications. An anti-virus can only act upon the information that it is given from the operating system, and if the information is bogus, the anti-virus is useless. The only way you can know that your computer is clean is to reformat it.This definitely doesn't mean anti-virus software is useless. As I said before, it can stop you from becoming infected in the first place - as it can find known viruses before you become infected. They are, however, useless once you have become infected.Nevon · #13but I sure as hell wouldn't entrust my banking information to a computer that I know has been (and still may be) infected, unless it has been reformatted.Ever heard of rootkits? For those unaware, its like a virus that hooks onto your OS and lives on your motherboard (i.e.: BIOS, etc.)